I recognize that this is an advisory post, but I have seen a number of people out there that shout this as a valid reason to not use Mastodon, which I hate, and I feel is such a lazy excuse.

You know what other sites don't have encrypted DMs?

- Twitter

- Facebook Messenger

- Instagram

- TikTok

- YouTube

- Reddit

- LinkedIn

- Email

and on and on.

Basically ANY major site that doesn't explicitly advertise DMs as E2E (or encrypted alone) can just be assumed to NOT be encrypted. So why complain about Mastodon alone then (again, directed at the hypothetical person).

Beyond that, yes it's a bit of an issue where the admins of an instance can read your DMs. If that's a problem, then you yourself can self-host an instance, or find a friend to do so, and enjoy peace of mind.

Or, just use an encryption method like PGP, encrypted online text paste services, saltstack, etc new fangled encryption methods, or send pre-encrypted files hosted on external services.

end rant blah